Flask weak secret key

Description

This Flask web application uses a weak or commonly-known secret key to sign session cookies. Flask relies on this secret key to cryptographically sign session data and prevent tampering. When a weak or default secret key is used, attackers can predict or discover the key, allowing them to forge valid session cookies with arbitrary data. This vulnerability was confirmed by successfully guessing the application's secret key.

Remediation

Replace the current SECRET_KEY with a cryptographically strong random value of at least 32 bytes. Generate the secret key using a secure random number generator and store it securely outside of your source code, such as in environment variables or a secure configuration management system.

To generate a strong secret key, use one of the following methods:

python -c 'import secrets; print(secrets.token_hex(32))'

import secrets
secret_key = secrets.token_hex(32)
# Store this value securely

import os
app.config['SECRET_KEY'] = os.environ.get('SECRET_KEY')
if not app.config['SECRET_KEY']:
    raise ValueError("No SECRET_KEY set for Flask application")

References

Related Vulnerabilities